rails/rails-html-sanitizer

Debian packaging 1.2.0: test issues

geor-g opened this issue · 7 comments

Hi,

I'm preparing 1.2.0 for Debian, and running into the following, which looks like quite minor, possibly related to encoding:

SanitizersTest#test_uri_escaping_of_href_attr_in_a_tag_in_safe_list_sanitizer = 0.00 s = F

Failure:
SanitizersTest#test_uri_escaping_of_href_attr_in_a_tag_in_safe_list_sanitizer [/<<PKGBUILDDIR>>/test/sanitizer_test.rb:490]:
--- expected
+++ actual
@@ -1 +1 @@
-"<a href=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>"
+"<a href=\"examp<!--%22%20unsafeattr=foo()>-->le.com\">test</a>"


SanitizersTest#test_uri_escaping_of_src_attr_in_a_tag_in_safe_list_sanitizer = 0.00 s = F

Failure:
SanitizersTest#test_uri_escaping_of_src_attr_in_a_tag_in_safe_list_sanitizer [/<<PKGBUILDDIR>>/test/sanitizer_test.rb:500]:
--- expected
+++ actual
@@ -1 +1 @@
-"<a src=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>"
+"<a src=\"examp<!--%22%20unsafeattr=foo()>-->le.com\">test</a>"


SanitizersTest#test_uri_escaping_of_name_action_in_a_tag_in_safe_list_sanitizer = 0.00 s = F

Failure:
SanitizersTest#test_uri_escaping_of_name_action_in_a_tag_in_safe_list_sanitizer [/<<PKGBUILDDIR>>/test/sanitizer_test.rb:520]:
--- expected
+++ actual
@@ -1 +1 @@
-"<a action=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>"
+"<a action=\"examp<!--%22%20unsafeattr=foo()>-->le.com\">test</a>"


SanitizersTest#test_uri_escaping_of_name_attr_in_a_tag_in_safe_list_sanitizer = 0.00 s = F


Failure:
SanitizersTest#test_uri_escaping_of_name_attr_in_a_tag_in_safe_list_sanitizer [/<<PKGBUILDDIR>>/test/sanitizer_test.rb:510]:
--- expected
+++ actual
@@ -1 +1 @@
-"<a name=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>"
+"<a name=\"examp<!--%22%20unsafeattr=foo()>-->le.com\">test</a>"


Finished in 0.128160s, 2387.6355 runs/s, 2520.2819 assertions/s.
306 runs, 323 assertions, 4 failures, 0 errors, 0 skips
rake aborted!

I'm happy to provide more details if needed.

Thanks for your work,
cheers!

I have same issue in Fedora:


  1) Failure:
SanitizersTest#test_uri_escaping_of_src_attr_in_a_tag_in_safe_list_sanitizer [/builddir/build/BUILD/rails-html-sanitizer-1.2.0/usr/share/gems/gems/rails-html-sanitizer-1.2.0/test/sanitizer_test.rb:500]:
--- expected
+++ actual
@@ -1,2 +1,2 @@
 # encoding: UTF-8
-"<a src=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>"
+"<a src=\"examp<!--%22%20unsafeattr=foo()>-->le.com\">test</a>"

  2) Failure:
SanitizersTest#test_uri_escaping_of_name_attr_in_a_tag_in_safe_list_sanitizer [/builddir/build/BUILD/rails-html-sanitizer-1.2.0/usr/share/gems/gems/rails-html-sanitizer-1.2.0/test/sanitizer_test.rb:510]:
--- expected
+++ actual
@@ -1,2 +1,2 @@
 # encoding: UTF-8
-"<a name=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>"
+"<a name=\"examp<!--%22%20unsafeattr=foo()>-->le.com\">test</a>"

  3) Failure:
SanitizersTest#test_uri_escaping_of_name_action_in_a_tag_in_safe_list_sanitizer [/builddir/build/BUILD/rails-html-sanitizer-1.2.0/usr/share/gems/gems/rails-html-sanitizer-1.2.0/test/sanitizer_test.rb:520]:
--- expected
+++ actual
@@ -1,2 +1,2 @@
 # encoding: UTF-8
-"<a action=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>"
+"<a action=\"examp<!--%22%20unsafeattr=foo()>-->le.com\">test</a>"

  4) Failure:
SanitizersTest#test_uri_escaping_of_href_attr_in_a_tag_in_safe_list_sanitizer [/builddir/build/BUILD/rails-html-sanitizer-1.2.0/usr/share/gems/gems/rails-html-sanitizer-1.2.0/test/sanitizer_test.rb:490]:
--- expected
+++ actual
@@ -1,2 +1,2 @@
 # encoding: UTF-8
-"<a href=\"examp&lt;!--%22%20unsafeattr=foo()&gt;--&gt;le.com\">test</a>"
+"<a href=\"examp<!--%22%20unsafeattr=foo()>-->le.com\">test</a>"

This is likely related to libxml. Which version is being used?

On Debian it's 2.9.4.

Are you building nokogiri using the system libraries? If that is the case that is the problem. Our test rely on the libxml version inside nokogiri so if there is a version mismatch they will fail.

Yes I do. Thanks for the explanation, I'll disable these, then.

Are you building nokogiri using the system libraries? If that is the case that is the problem. Our test rely on the libxml version inside nokogiri so if there is a version mismatch they will fail.

Yes. FTR: on Fedora we're using versions are: nokogiri-1.10.4 libxml2-2.9.9

voxik commented

Just FTR, these were already modified once:

3ca8a87

So that seems libxml2 have changed the escaping but later partially reverted to not escape the <, >.